In the Linux kernel, the following vulnerability has been resolved:
rcu: Protect rcuprinttaskexpstall() ->exp_tasks access
For kernels built with CONFIGPREEMPTRCU=y, the following scenario can result in a NULL-pointer dereference:
CPU1 CPU2
rcupreemptdeferredqsirqrestore rcuprinttaskexpstall if (special.b.blocked) READONCE(rnp->exptasks) != NULL rawspinlockrcunode np = rcunextnodeentry(t, rnp) if (&t->rcunodeentry == rnp->exptasks) WRITEONCE(rnp->exptasks, np) .... rawspinunlockirqrestorercunode rawspinlockirqsavercunode t = listentry(rnp->exptasks->prev, struct taskstruct, rcunodeentry) (if rnp->exptasks is NULL, this will dereference a NULL pointer)
The problem is that CPU2 accesses the rcunode structure's->exptasks field without holding the rcunode structure's ->lock and CPU2 did not observe CPU1's change to rcunode structure's ->exptasks in time. Therefore, if CPU1 sets rcunode structure's->exp_tasks pointer to NULL, then CPU2 might dereference that NULL pointer.
This commit therefore holds the rcunode structure's ->lock while accessing that structure's->exptasks field.
[ paulmck: Apply Frederic Weisbecker feedback. ]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53419.json"
}